What is GHSA-h98r-h4wc-7hjr?

GHSA-h98r-h4wc-7hjr is a security advisory published by GitHub Security Advisories with unknown severity. The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an...

Which CVE IDs does GHSA-h98r-h4wc-7hjr cover?

GHSA-h98r-h4wc-7hjr covers the following CVE IDs: CVE-2026-13332. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-h98r-h4wc-7hjrunknown

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an...

Vendor

GitHub Security Advisories

Published

July 27, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-13332 →

📋 Description

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13332
https://wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94
https://github.com/advisories/GHSA-h98r-h4wc-7hjr